Two Amazon EC2 instances located in different subnets are unable to communicate with each other, even though other hosts in the same subnets can communicate and the security groups have appropriate ALLOW rules. Which troubleshooting step should be performed?

The correct answer is to inspect inbound and outbound network ACL rules for DENY entries. Network ACLs (NACLs) are stateless and evaluate rules in order, from lowest to highest. If a DENY rule is encountered that matches the traffic, the traffic is blocked, regardless of any subsequent ALLOW rules. Unlike security groups, which are stateful and implicitly deny all traffic not explicitly allowed, NACLs require explicit DENY rules to block traffic. Since other hosts in the same subnets can communicate and security groups are correctly configured, the problem likely lies with a NACL. Security groups do not have explicit DENY statements, making that option incorrect. VPC Flow Logs can show rejected packets but don't directly pinpoint the NACL rule causing the issue. AWS X-Ray is for application-level tracing, not network connectivity troubleshooting.